Failure Mode and Effects Analysis (FMEA): Risk Table

ISO 14971:2019 Section	Document Section
5.2	(all; entries about reasonably foreseeable misuse)
5.4	3
5.5	3, 4
6	3
7.1	4
7.2	4
7.3	4
7.5	4

IEC 62366-1:2015 Section	Title	Document Section
4.1.2	Risk Control as it relates to User Interface design	4
5.3	Identify known or foreseeable Hazards and Hazardous Situations	1,3

This is a Failure Mode and Effects Analysis (FMEA) of the device. It is separated into multiple sections:

• Failure Modes lists everything which can go wrong

• Hazards and Analysis lists everything (harms) which can subsequently happen, including an analysis of probability and severity

• The list of Risk Control Measures which contains all control measures which were implemented for risk reduction, either reducing probability or severity, or both.

1. Preliminary Hazards Analysis (PHA)

Table 1 Preliminary Hazards Analysis

ID	Source	Description	Hazard ID(s)
1	Intended Use	Avoidance organ under-contoured	1
2	Intended Use	Avoidance organ over-contouring	2
3	Intended Use	Target under-contouring	3
4	Intended Use	Target over-contouring	4
5	Technical considerations	No contour produced	5
6	Technical considerations	Delay in contour production	6
7	Usability	Contour misidentified	7
8	IT Security	Leakage of Patient Information	8

2. Failure Modes

Table 2 Failure Modes

ID	Failure Mode	Hazard ID(s)
1	Incorrect contour	1, 2, 3, 4, 5
2	Security breach	8
3	Cloud server computation bottlenecks	6

3. Hazards and Analysis

Table 3 Hazards, Hazardous Situations, and Harm

ID	Hazard	p1	Hazardous Situation	p2	Harm
1	Avoidance organ under-contoured	10^-5	Radiotherapy treatment plan created and delivered to the patient which irradiates the under-contoured region	10^-3	Death or serious disablement
2	Avoidance organ over-contouring	10^-5	Radiotherapy treatment plan created and delivered to the patient which compromises too much on target	10^-2	Reduced treatment outcomes
3	Target under-contouring	10^-3	Radiotherapy treatment plan created and delivered to the patient which compromises too much on target	10^-2	Major treatment protocol deviation, significantly reduced treatment outcomes
4	Target over-contouring	10^-3	Radiotherapy treatment plan created and delivered to the patient where a compromise was needed between organ at risk and the target due to its over contouring	10^-2	Increased treatment side-effects
5	No contour produced	10^-5	Radiotherapy treatment plan created and delivered to the patient irradiating the organ	10^-2	Death or serious disablement
6	Delay in contour production	10^-2	Contour needs to be undergone manually following current standard practice	10^-2	Delay in treatment
7	Contour misidentified	10^-5	Radiotherapy treatment plan created and delivered to the patient irradiating the organ	10^-2	Death or serious disablement
8	Leakage of Patient Information	10^-6	Cloud server security breach	10^-1	Patient identifying data leak

Table 4 Analysis without risk controls

ID	p1*p2	P	S	Acceptable without risk controls?
1	10^-8	P2	S5	No
2	10^-7	P3	S3	Yes
3	10^-5	P4	S4	No
4	10^-5	P4	S2	Yes
5	10^-7	P3	S5	No
6	10^-4	P4	S1	Yes
7	10^-7	P3	S5	No
8	10^-7	P3	S3	Yes

Table 5 Analysis with external risk controls

ID	External Risk Control ID(s)	P	S	Acceptable with external risk controls?
1	1, 2	P1	S5	Yes
2	1, 2	P1	S3	Yes
3	1, 2	P2	S4	Yes
4	1, 2	P2	S2	Yes
5	1, 2	P1	S5	Yes
6		P4	S1	Yes
7	1, 2	P1	S5	Yes
8		P3	S3	Yes

Table 6 Analysis with external and internal risk controls

ID	Internal Risk Control ID(s)	P	S	Acceptable with all risk controls?
1	3	P1	S5	Yes
2	3	P1	S3	Yes
3	3	P1	S4	Yes
4	3	P1	S2	Yes
5	3	P1	S5	Yes
6		P4	S1	Yes
7	3	P1	S5	Yes
8	4	P3	S2	Yes

4. Risk Control Measures

Table 7 Risk Control Measures

ID	Description	Type	Probability Reduction	Severity Reduction
1	The contour data is provided to an independent software treatment planning system where that independent software is utilised for refinement and approval by a relevant qualified health practitioner.	External measure – Health care procedure	10^2	0
2	The subsequent refined contours are then reviewed by at least one other independent relevant qualified health practitioner. Generally however the whole plan, including the contours goes through multiple independent reviewers before being utilised for treatment.	External measure – Health care procedure	10^2	0
3	After the refinements have been completed they are sent back to the software. The level of refinements are then compared to the original model results and feedback on this compared to the standard amount of refinement generally undergone for that contour type is then provided via notification to an independent relevant qualified health practitioner.	Internal measure – Information for safety	10^2	0
4	All identifying patient information is deidentified prior to submitting the data to the cloud server	Internal measure – Protective measure	0	1